#444

backend/spec/services/counts_pivot_security_spec.rb

@@ -142,7 +142,7 @@ RSpec.describe 'Counts masked pivot contracts' do
     expect(page[:row_headers]).to include(hash_including(values: [nil], kind: 'data'))
   end
 
-  it 'sorts public numeric values numerically alongside a masked group' do
+  it 'sorts public version numbers numerically including formerly hidden records' do
     post = PostVersion.order(:id).last.post
     [2, 10].each do |number|
       PostVersion.create!(post:, version_no: number, event_type: 'update',
@@ -151,22 +151,47 @@ RSpec.describe 'Counts masked pivot contracts' do
     end
     page = result(nil, 'rows' => 'version_no', 'cols' => '')
     values = page[:row_headers].select { _1[:kind] == 'data' }.map { _1[:values].first }
-    expect(values.reject { _1 == CountsAxes::MASKED_VALUE }.map(&:to_i)).to eq([1, 2, 10])
-    expect(values.last).to eq(CountsAxes::MASKED_VALUE)
+    expect(values.map(&:to_i)).to eq([1, 2, 10])
   end
 
-  it 'rejects private predicates and supplied measure coordinates before SQL labels escape' do
-    probes = [{ 'resource_id' => PostVersion.first.post_id.to_s },
-        { 'tags' => 'A' },
-        { 'conditions' => '', 'conditions.0.field' => 'title', 'conditions.0.operator' => 'eq',
-          'conditions.0.value' => 'hidden-title-0' },
-        { 'drill' => '', 'drill.0.field' => 'tags', 'drill.0.value_type' => 'string',
-          'drill.0.value' => "internal:#{ tags.first.id }" },
+  it 'uses public identity fields and masked values for unauthorised filters' do
+    hidden_id = PostVersion.first.post_id.to_s
+    base = { 'rows' => '', 'cols' => '' }
+    condition = lambda do |field, operator, value|
+      { 'conditions' => '', 'conditions.0.field' => field,
+        'conditions.0.operator' => operator, 'conditions.0.value' => value }
+    end
+
+    expect(result(nil, base.merge('resource_id' => hidden_id))[:cells].sole[:count]).to eq(2)
+    expect(result(nil, base.merge(condition.call('version_no', 'eq', '2')))[:cells]
+        .sole[:count]).to eq(2)
+    expect(result(nil, base.merge(condition.call('user', 'eq', member.id.to_s)))[:cells]
+        .sole[:count]).to eq(5)
+    expect(result(nil, base.merge(condition.call('title', 'eq', 'hidden-title-0')))[:cells]
+        .sole[:count]).to eq(0)
+    expect(result(nil, base.merge(condition.call('title', 'ne', 'hidden-title-0')))[:cells]
+        .sole[:count]).to eq(5)
+    expect(result(nil, base.merge(condition.call('title', 'eq', '********')))[:cells]
+        .sole[:count]).to eq(4)
+    expect(result(nil, base.merge(condition.call('video_ms', 'eq', '********')))[:cells]
+        .sole[:count]).to eq(4)
+    expect(result(nil, base.merge(condition.call('title', 'like', '%title%')))[:cells]
+        .sole[:count]).to eq(1)
+    expect(result(nil, base.merge(condition.call('title', 'like', '%')))[:cells]
+        .sole[:count]).to eq(5)
+    expect(result(nil, base.merge('tags' => 'C'))[:cells].sole[:count]).to eq(1)
+    expect(result(nil, base.merge('tags' => 'not:C'))[:cells].sole[:count]).to eq(4)
+  end
+
+  it 'rejects server-only coordinates in column order and drilldown' do
+    probes = [
         { 'cols' => 'tags', 'column_order' => '', 'column_order.0.value_type' => 'string',
-          'column_order.0.value' => CountsAxes::MASKED_VALUE }]
+          'column_order.0.value' => CountsAxes::MASKED_VALUE },
+        { 'drill' => '', 'drill.0.field' => 'tags', 'drill.0.value_type' => 'string',
+          'drill.0.value' => CountsAxes::MASKED_VALUE }]
     HistoryAccess.set(user: nil) do
       probes.each do |probe|
-        expect { CountsTableQuery.new(params.merge(probe)) }
+        expect { CountsTableQuery.new(params.merge(probe)).call }
             .to raise_error(CountsAxes::PrivateCondition)
       end
     end